Path traversal lets an attacker read files outside the folder an application intended, using sequences like ../. File inclusion goes further: the application loads and sometimes executes the file, either from the server itself (local file inclusion, LFI) or from another server (remote file inclusion, RFI).

How it happens

A parameter such as ?file=report.pdf or ?page=about is joined onto a file path. By changing it to something like ../../etc/passwd, or an encoded variant, the attacker walks out of the intended directory. In archive handling, a similar flaw called "zip slip" writes files outside the extraction folder.

Why it matters

• Disclosure of configuration files, source code and credentials.
• Remote code execution when an included file is executed.
• Tampering with files when write paths are affected.

How to prevent it

• Never build file paths from user input; map IDs to files on the server instead.
• Canonicalise the path and verify it stays inside the allowed base directory.
• Disable remote includes in your language runtime.
• Validate archive entry names before extracting.

How Vooki Pro helps

• Tests for path traversal, LFI and RFI, and for path normalisation and encoding bypasses (double URL encoding, overlong UTF-8, null bytes).
• Checks archive uploads for zip slip.
• Detects exposed directory listings and backup files that often accompany these flaws.
• Reports each finding with evidence, CVSS score and remediation steps.

Frequently asked questions

What is the difference between path traversal and LFI?

Path traversal reads files outside the intended folder. Local file inclusion loads, and sometimes executes, those files as part of the application, which can lead to code execution.

What is zip slip?

Zip slip is a path traversal flaw in archive extraction, where file names like ../../file write outside the target folder.

Related: IDOR and broken object-level authorization (BOLA) · Insecure file upload